tailscale/tailscale · error

CSRF request denied with no Host header

Error message

CSRF request denied with no Host header

What it means

CSRF fallback validation: the request had no Sec-Fetch-Site header (typical for plain HTTP) and also carried no Host header, so the expected origin for the Origin/Host comparison cannot be established.

Source

Thrown at client/web/web.go:268

		// browsers to "potentially trustworthy" origins i.e. localhost or those
		// served over HTTPS)
		secFetchSite := r.Header.Get("Sec-Fetch-Site")
		if secFetchSite == "same-origin" {
			h.ServeHTTP(w, r)
			return
		} else if secFetchSite != "" {
			http.Error(w, fmt.Sprintf("CSRF request denied with Sec-Fetch-Site %q", secFetchSite), http.StatusForbidden)
			return
		}

		// if Sec-Fetch-Site is not available we presume we are operating over HTTP.
		// We fall back to comparing the Origin & Host headers.

		// use the Host header to determine the expected origin
		// (use the override if set to allow for reverse proxying)
		host := r.Host
		if host == "" {
			http.Error(w, "CSRF request denied with no Host header", http.StatusForbidden)
			return
		}
		if s.originOverride != "" {
			host = s.originOverride
		}

		originHeader := r.Header.Get("Origin")
		if originHeader == "" {
			http.Error(w, "CSRF request denied with no Origin header", http.StatusForbidden)
			return
		}
		parsedOrigin, err := url.Parse(originHeader)
		if err != nil {
			http.Error(w, fmt.Sprintf("CSRF request denied with invalid Origin %q", r.Header.Get("Origin")), http.StatusForbidden)
			return
		}
		origin := parsedOrigin.Host
		if origin == "" {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Send requests through a proper HTTP client that sets Host
2. Check for a misconfigured reverse proxy stripping the Host header
3. Use HTTPS so Sec-Fetch-Site is available instead

When it happens

Trigger: Thrown at client/web/web.go:268 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/818deffcf3dee155. Report an issue: GitHub.